Apache Tomcat known exploited vulnerabilities, ranked
CISA lists 6 Apache Tomcat CVEs as exploited in the wild. 1 were added in the last 12 months and 1 are known to be used in ransomware. The table ranks all of them by EPSS, FIRST's estimate of the chance a CVE is exploited in the next 30 days, so the first rows are the ones to patch first.
Patch these first
- CVE-2017-12617: EPSS 99.97%, added 2022-03-25
- CVE-2025-24813: EPSS 99.93%, added 2025-04-01
- CVE-2017-12615: EPSS 99.64%, used in ransomware, added 2022-03-25
- CVE-2020-1938: EPSS 99.27%, added 2022-03-03
- CVE-2016-8735: EPSS 90.3%, added 2023-05-12
All 6 Apache Tomcat CVEs in CISA KEV, by EPSS
| # | CVE | Flaw | EPSS | Ransomware | Added | Federal due |
|---|---|---|---|---|---|---|
| 1 | CVE-2017-12617 | Tomcat Remote Code Execution | 99.97% | – | 2022-03-25 | 2022-04-15 |
| 2 | CVE-2025-24813 | Tomcat Path Equivalence | 99.93% | – | 2025-04-01 | 2025-04-22 |
| 3 | CVE-2017-12615 | Tomcat on Windows Remote Code Execution | 99.64% | Yes | 2022-03-25 | 2022-04-15 |
| 4 | CVE-2020-1938 | Tomcat Improper Privilege Management | 99.27% | – | 2022-03-03 | 2022-03-17 |
| 5 | CVE-2016-8735 | Tomcat Remote Code Execution | 90.3% | – | 2023-05-12 | 2023-06-02 |
| 6 | CVE-2026-34486 | Tomcat Missing Encryption of Sensitive Data | 6.6% | – | 2026-08-04 | 2026-08-07 |
EPSS changes daily; a CVE with a low EPSS that is in KEV is still exploited somewhere. Federal due dates bind US federal civilian agencies; everyone else can use them as a priority hint.
Sources: CISA KEV, FIRST EPSS.
More: all Apache KEV CVEs · other Apache products: Struts · free KEV badge for Apache · all vendors